Yootheme Pro Extension For Joomla
Approved changes feed: RSS · Atom
cpe:2.3:a:yootheme.com:yootheme_pro_extension_for_joomla:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Yootheme.Com (895d650c-5b79-5e55-ade1-723d760ca5d3) |
|---|---|
| Product | Yootheme Pro Extension For Joomla (ea21539a-3b5c-5e25-9b34-45da48c71c61) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-102785 |
vulnerable | 2026-11-03 10:15:44.210761 |
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Published: 2026-10-22T12:36:43.196Z
Updated: 2026-10-22T15:04:40.346Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.